Re: "closed-port" backdoors

[Joe Boyle <jboyle () PRIMARYKNOWLEDGE COM>]

In phrack magazine (issue 52), there is an article describing some techniques
to weaken linux using LKMs, including complete source.  One of the features of
the module is to overload the socket system call so that whenever a packet is
received using recvfrom(), the size of the packet is inspected.  if it matches
a magic size, a command is executed locally.

so, it isnt exactly what you asked for but I believe it could be readily
modified to do what you described.

http://phrack.infonexus.com/search.phtml?view&article=p52-18

joe

On Wed, 21 Mar 2001, Andreas Hasenack wrote:
> Has somebody seen in the wild a type of backdoor where
> no ports are open until a specifig set of packets are sent
> to the machine?
> For example, the backdoor would only bind to port X if
> the machine receives SYN packets to three other ports in
> sequence. I've seen code to do this (and sorry if it's not
> new), but I haven't seen rootkits using it.